US5896499A

Movatterモバイル変換

Info

Publication number: US5896499A
Application number: US08/803,661
Authority: US
Inventors: Mark Ambrose McKelvey
Original assignee: International Business Machines Corp
Current assignee: International Business Machines Corp
Priority date: 1997-02-21
Filing date: 1997-02-21
Publication date: 1999-04-20
Anticipated expiration: 2017-02-21
Also published as: WO1998037490A1

Abstract

An embedded security processor is used in conjunction with a main processor to provide security for a computer system that is accessible via a computer network. In a preferred embodiment of the present invention, an expansion board is provided that has an embedded security processor dedicated to network communications security tasks. The embedded security processor is controlled by the main processor and intercepts all communications from external untrusted or unverified network systems (i.e., unsecure networks) and verifies that the attempted communication is permissible before allowing the external network communication traffic to access the main processor, or other networked computer resources accessible via a secure network.

Description

BACKGROUND OF THE INVENTION

1. Technical Field

This invention generally relates to computer security, and more specifically relates to a computer security system for computers connected to an Intranet, the Internet, the world-wide web, or other computer networks.

2. Background Art

The development of the EDVAC computer system of 1948 is often cited as the beginning of the computer era. Since that time, computer systems have evolved into extremely sophisticated devices, and computer systems may be found in many different settings. Computer systems typically include a combination of hardware (e.g., semiconductors, circuit boards, etc.) and software (e.g., computer programs). As advances in semiconductor processing and computer architecture push the performance of the computer hardware higher, more sophisticated computer software has evolved to take advantage of the higher performance of the hardware, resulting in computer systems today that are much more powerful that just a few years ago.

Other changes in technology have also profoundly affected how we use computers. For example, the widespread proliferation of computers has prompted the development of computer networks that allow computers to communicate quickly and efficiently with each other. With the introduction of the personal computer (PC), computing became accessible to large numbers of people. Networks for personal computers were developed to allow individual users to communicate with each other. In this manner, a large number of people within a company or other organization could communicate at the same time with a software application running on one computer system.

One significant computer network that has become very popular is the Internet. The Internet grew out of the modem proliferation of computers and networks and has currently evolved into a sophisticated worldwide network of computer systems linked together. The Internet is considered an "unsecure" network because anyone with the necessary computer equipment has access to the information that is transmitted on the Internet. If an individual wishes to protect their transmitted information from being received or intercepted by unauthorized individuals, then additional software or hardware must be provided.

In addition to the Internet and other types of public networks, private computer networks presently exist in many different forms and serve many purposes. For example, there are credit card computer networks which direct network traffic to banks for authorizations and transaction posting, there are university computer networks which maintain student or scientific research information, and there are many private company computer networks which contain a variety of proprietary information.

Another recent development in the area of computer networks is the proliferation of "Intranets." Intranets are typically networks of computer workstations, and/or computer resources or systems that belong to a single company, division, or branch of a company. Intranets are considered "secure" networks because they are typically connected to an outside or external network via a security system that restricts access to only authorized users. Intranets are considered to be more secure than other types of public computer networks because they can be isolated from other, outside networks. The rapid expansion of computer networks and the technological advances in communication equipment promises to bring even more connectivity to computer networks through such mechanisms as cable modems, computerized home televisions, and direct access multimedia services.

Along with the explosive growth experienced by computer networks in the past few years, an ever increasing concern is the need to provide enhanced security protection for networked computer systems and resources. In particular, where private computer resources (i.e., software applications, data files, World Wide Web pages, etc.) are accessed using standard Internet communication tools, security must be provided to protect the private resources from unauthorized access. This involves ensuring that access to networked resources is granted only to approved users, whether the users are within a company or external to the company. For example, many companies have remote offices or branches located in various parts of the country. Each office or branch may operate and maintain a computer network and each of these local computer networks may be interconnected in a company-wide computer network or tied together via the Internet. It is often desirable in this type of computer network environment to prevent unauthorized access to one of the local computer networks from another of the local computer networks and also to restrict access by unauthorized Internet users.

This network communication technique is often used on private computer networks as well. Private computer networks are often linked to other private computer networks, such as in a company where multiple user groups exist in the organization with corresponding multiple computer networks. The risk of break-ins and computer misuse in one private network by users of another private network is also present. For example, a disgruntled employee working from a local area network (LAN) in one organization of the company may break into the private computer network of another organization with the company and cause files to be altered or erased. Alternatively, someone may introduce viruses or other illicit and destructive computer programs such as Trojan horses or worms into the network environment.

Another network communication security issue that should be addressed when transmitting sensitive information is the unavoidable problem of an authorized party examining communications in transit whenever a public or unsecure network is used. Data to be sent from one location to another is divided or broken down into "packets." The packets are individually routed or sent over the network and then reassembled at the appropriate destination. As part of the communication transmission process, certain information regarding the origin, destination, and contents of a transmission is packaged and sent along with the actual data packets being transmitted. By examining or "sniffing" the packet and utilizing the packet information, unscrupulous intruders can mimic legitimate network communication traffic and gain access to otherwise secure networks.

The most common and simplest type of firewall is one that simply does packet filtering. This type of firewall can block undesirable in-coming traffic while allowing outgoing traffic to continue to be processed. Packet filtering firewalls are relatively inexpensive since most network routers currently provide the ability to specify various rules for filtering in-coming packets. Unfortunately, a packet-filtering firewall system suffers from a number of significant drawbacks. These drawbacks include little or no activity logging, exposure of Internet addresses and other network information to public access, and the complex filtering scenarios typically required to handle communications with multiple computer systems.

Another common firewall system is called a dual-homed gateway firewall. A dual-homed gateway consists of a system with two network interfaces that requires that all network communication traffic between the secure network and the unsecure network must pass through the gateway. Normal packet routing and forwarding features are disabled, so an alternative communication mechanism such as proxies or servers must be used. Depending on the availability of proxies and servers, this type of firewall can be very restrictive. In addition, because all network communication traffic must pass through the gateway, overall throughput and system performance may suffer.

While useful, the addition of a firewall computer system generally introduces a significant level of complexity into a network environment. No matter which type of firewall system is utilized, security concerns common to firewall systems in general remain. For example, the firewall computer system must be secured in a protected location where physical access can be controlled. Otherwise, the protected system may be compromised by a direct physical attack on the firewall computer system. Firewall systems must be initially set-up or configured, and occasionally must be reconfigured as the network environment and the nature of the protected systems changes and develops. The initial set-up will typically include installing the operating system, installing the communication software, and customizing the operating system for the specific network environment. The reconfiguration process, whereby the system parameters are changed or otherwise updated, is typically time-consuming and may introduce inadvertent security errors.

In addition, for the sake of convenience, it is often desirable to monitor and control the activity of the firewall system from a remote location. However, remote access capability opens the firewall computer system up to the possibility of tampering or unauthorized access by a system intruder such as a hacker or cracker. After breaking into private computer networks, crackers have been able to erase files or disks, cancel programs, retrieve sensitive information and even introduce computer viruses. Skilled intruders can also disable monitoring and logging facilities so that their presence is undetected. Intruders will then reconfigure the firewall system so as to allow undesirable network communication traffic through the firewall, thereby compromising the security of the protected system.

Without improved methods for providing security and protection for networked computer resources, computer systems will remain less secure and open to potentially devastating attacks, even if protected by a standard firewall system. As businesses increasingly utilize public networks such as the Internet to provide site-to-site connectivity, a common need exists to increase the level of protection available with firewalls, thereby more effectively protecting the networked computer resources. Without a mechanism that is capable of providing increased levels of security between computer systems and resources currently available via networks, network communications and transactions between network users and remote locations will be subject to unnecessary compromise.

DISCLOSURE OF INVENTION

According to the present invention, an embedded security processor is used in conjunction with a main processor to provide security for a computer system that is accessible via a computer network. In a preferred embodiment of the present invention, an expansion board is provided that has an embedded security processor dedicated to network communications security tasks. The embedded security processor is controlled by the main processor and intercepts all communications from external untrusted or unverified network systems (i.e., unsecure networks) and verifies that the attempted communication is permissible before allowing the external network communication traffic to access the main processor via the system bus, or other networked computer resources accessible via a secure network.

The foregoing and other features and advantages of the invention will be apparent from the following more particular description of preferred embodiments of the invention, as illustrated in the accompanying drawings.

BRIEF DESCRIPTION OF DRAWINGS

The preferred embodiments of the present invention will hereinafter be described in conjunction with the appended drawings, where like designations denote like elements, and:

FIG. 1 is a block diagram of a computer system in accordance with a preferred embodiment of the present invention;

FIG. 2 is a block diagram of a known firewall computer system in a network environment; and

FIG. 3 is a block diagram showing how the computer system of FIG. 1 may be used for firewall protection for a secure network.

BEST MODE FOR CARRYING OUT THE INVENTION

The Overview Section immediately below is intended to provide an introductory explanation of various types of firewalls for individuals who need additional background in this area. Those who are skilled in the art may wish to skip this section and begin with the Detailed Description section instead.

OVERVIEW

Host-based firewalls, also known as dual-homed firewalls, provide a level of security for networked computer resources by interposing a separate computer system between the private, secure network and the Internet or other public, unsecure network. In some dual-homed firewalls, Internet Protocol (IP) packet forwarding is disabled, preventing the firewall from routing IP packets automatically according to the addresses provided. Such dual-homed firewalls also provide a special set of Transmission Control Protocol (TCP) applications to act as proxy agents to communicate with users outside of the secure network. In this way, the firewall maintains control over the communications which enter and exit the secure network. A disadvantage of host-based firewalls is the continual need to increase the size of the firewall system to support increased traffic between the secure network and the unsecure network. Another disadvantage of host-based firewalls is that crackers need only to overcome the security defenses of a single computer system in order to gain access to the secure network.

Another type firewall system, known as a bastion host, and also known as an application level firewall, overcomes the capacity disadvantage of host-based firewall systems by providing a subnetwork of hosts to control traffic in and out of the secure network. The subnetwork can be expanded by adding hosts as capacity need increases. With bastion hosts, the unsecure network is permitted to access only up to an exterior router R2, while the secure network is permitted to access only up to an interior router R1. Between the routers, a group of proxy hosts are provided that control access to various applications available for communication with the secure and unsecure networks. A disadvantage of this system is that code must be specially written to specify each application to be allowed through the subnetwork, making changes in applications availability costly and time-consuming. Another disadvantage is the cost and complexity of maintaining a separate subnet and multiple computer systems as hosts for the system.

Referring now to FIG. 2, a typical firewall-protectedsystem 200 includes: afirewall computer system 210 and a series of firewall protectedcomputers 220.Firewall computer system 210 includes network interfaces 175 and 177. Firewall protectedcomputer systems 220 are "shielded" from the Internet or other unsecure network byfirewall computer system 210. Any of the security methods or techniques used above may be employed infirewall computer system 210.Network interface 175 is used to connect firewall computer system to the secure network that allows communication betweenfirewall computer system 210 and firewall protectedcomputer systems 220. The unsecure network is connected usingnetwork interface 177 and all external network communication with firewall protectedcomputer systems 220 must pass throughfirewall 210.

DETAILED DESCRIPTION

According to the present invention, an embedded security processor is used to provide security for a computer system that is accessible via a computer network. In a preferred embodiment of the present invention, an expansion board is coupled to the system bus with a secondary embedded security processor dedicated to network communications security tasks. The secondary embedded security processor is controlled by the main processor and intercepts all communications from external untrusted or unverified network systems and verifies that the attempted communication is permissible before allowing the external network communication traffic to have access to the main processor or other networked computer resources.

Referring now to FIG. 1, acomputer system 100 with an embedded security processor in accordance with a preferred embodiment of the present invention includes: asystem bus 105; acontrol signal 115; amain processor 110; anoptional network interface 120; amain memory 130; auser authentication program 140; aninitial firewall configuration 150; afirewall monitoring program 160; anexpansion board 170; and a Direct Access Storage Drive (DASD) 180.Expansion board 170 includes: a secondary or Input/Output (I/O)memory 171; a secondary or embeddedsecurity processor 173; afirst network interface 175; and asecond network interface 177.

System bus 105 serves to transmit programs, data, status and other forms of information or signals between the various components ofsystem 100. The preferred embodiment forsystem bus 105 uses a tightly-coupled system bus betweenmain processor 110 and embeddedsecurity processor 173. However, in alternative embodiments,system bus 105 may be any suitable physical or logical means of connecting computer systems and components known to those skilled in the art. This includes, but is not limited to, direct hard-wired connections, Internet connections, Intranet connections, fiber optics, infrared (IR) and other forms of wireless connections. It is anticipated that many alternative methods and material for connecting computer systems and components will be readily adapted for use with the present invention. This would include those methods and materials not presently known but developed in the future.

Control signal 115 is a signal or a group of signals transmitted frommain processor 110 to embeddedsecurity processor 173. Whilecontrol signal 115 is shown as a separate line in FIG. 1,control signal 115 may also be incorporated in tosystem bus 105 and may be a part ofsystem bus 105.Main processor 110 controls the operation of embeddedsecurity processor 173 usingcontrol signal 115. For example,control signal 115 is capable of disabling embeddedsecurity processor 173 and can shut off the electrical power supply that provides power to embeddedsecurity processor 173.

Network interfaces 120, 175, and 177 may be any type of interface known to those skilled in the art for providing connections to computer systems and networks. For example, in the case of a Local Area Network (LAN), the network interfaces could be token-ring adapters, Ethernet adapters, etc. In the case of a Wide Area Network (WAN), the network interfaces could be ISDN adapters, serial modems, cable modems, etc.

Main processor 110 controls the communication between the various elements ofsystem 100 by monitoringsystem bus 105.Main processor 110 may permit selected elements to communicate with other elements directly or may require them to communicate only withmain processor 110 with appropriate communication traffic being forwarded bymain processor 110.Main processor 110 may also limit the scope of interaction between various components. For example, embeddedsecurity processor 173 may perform read-only operations on selected portions ofDASD 180. In a preferred embodiment, embeddedsecurity processor 173 is restricted to communicating only withmain processor 110. This effectively isolates embeddedsecurity processor 173 from the other protected or secure components ofsystem 100.Main processor 110 will forward the communication to the appropriate system component or location after verifying that the request or communication is valid and proper.

Main processor 110 may be implemented as a single Central Processing Unit (CPU) or as a combination of multiple specialty microprocessors which work in concert to perform computation and control functions ofsystem 100. All CPUs associated withsystem 100 may each individually comprise a single integrated circuit, such as a microprocessor, or may comprise any suitable number of integrated circuit devices and/or circuit boards working in cooperation to accomplish the functions of a central processing unit. All CPUs are capable of suitably executing the programs contained withinmain memory 130 and acting in response to those programs or other activities that may occur insystem 100.

Main memory 130 may be any type of memory device or component known to those skilled in the art. This would include Dynamic Random Access Memory (DRAM), Static RAM (SRAM), flash memory, cache memory, etc. While not explicitly shown in FIG. 1,main memory 130 may be a single type of memory component or may be composed of many different types of memory components.

As shown in FIG. 1,DASD 180 may be a floppy disk drive which is capable of reading and writing programs or data onfloppy disk 190.DASD 180 may also be any other type of DASD known to those skilled in the art. This would include CD-ROM drives, hard disk drives, optical drives, etc.Floppy disk 190 represents a typical 3.5 inch magnetic media disk known to those skilled in the art. In a preferred embodiment of the present invention,DASD 180 is configured so that portions of the storage device that contain the security programs that are executed by embeddedsecurity processor 173 are protected, and cannot be updated by embeddedsecurity processor 173. In a preferred embodiment, all attempts and requests for updates or changes to any security program or feature must be routed throughmain processor 110 as described above. After receiving and approving the request,main processor 110 may retrieve the requested data and control the transfer of the requested data or, alternatively,main processor 110 may allow embeddedsecurity processor 173 to access the requested data directly by using an authorization signal transmitted to embeddedsecurity processor 173.

Expansion board 170 provides the security features forsystem 100.Expansion board 170 includes: embeddedsecurity processor 173; I/O memory 171; and

network interfaces

175 and 177. One preferred embodiment ofexpansion board 170 is an after-market hardware/software solution designed to be placed into an existing computer system to provide enhanced firewall capabilities for networked computer resources. Another preferred embodiment of the present invention may be incorporated as an integral component ofsystem 100 at thetime system 100 is initially manufactured.

Embeddedsecurity processor 173 may be implemented as a single Central Processing Unit (CPU) or as a combination of multiple specialized microprocessors which work in concert to perform computation and control functions ofexpansion board 170. Embeddedsecurity processor 173 may comprise a single integrated circuit, such as a microprocessor, or may comprise any suitable number of integrated circuit devices and/or circuit boards working in cooperation to accomplish the functions of a central processing unit. Embeddedsecurity processor 173 is capable of suitably executing the programs contained within I/O memory 171 and acting in response to those programs or other activities that may occur inexpansion board 170.

In some preferred embodiments of the present invention, it may be desirable to includemultiple expansion boards 170. These expansion boards may be connected to multiple unsecure networks or to the same unsecure network.Multiple expansion boards 170 can be used to increase system throughput and availability/reliability. The expansion boards may be placed inside a single computer insystem 100 or, alternatively, in multiple computer systems that are attached to the same secure network.

I/O memory 171 may be any type of memory device or component known to those skilled in the art. This would include Dynamic Random Access Memory (DRAM), Static RAM (SRAM), flash memory, cache memory, etc. While not explicitly shown in FIG. 1, I/O memory 171 may be a single type of memory component or may be composed of many different types of memory components. I/O memory 171 serves as a storage location for utilization by embeddedsecurity processor 173.

Network interfaces 175 and 177 are hardware components specifically adapted to provide an interface or connection to their respective networks. The exact configuration of

network interfaces

175 and 177 is a design choice that will depend on the type of network connection desired and the availability of various types of connections for a given network hardware/software protocol.Network interface 175 may be used by other computer systems on the internal secure network to access information and communicate via the Internet or other unsecure network. The communications traffic can be processed by embeddedsecurity processor 173 while the operation of the embeddedsecurity processor 173 is monitored bymain processor 110. It is important to note that embeddedsecurity processor 173 protects not only the computer system in which it resides, but embeddedsecurity processor 173 can also perform firewall and related security functions for other computers or networked computer resources insystem 100 that are attached to the internal secure network viasystem bus 105.

In order to provide firewall security protection against unwanted traffic over an unsecure network such as the Internet,network interface 177 located onexpansion board 170 can be connected to the unsecure network. Embeddedsecurity processor 173 is under the control ofmain processor 110.Main processor 110 controls embeddedsecurity processor 173 viacontrol signal 115.Main processor 110 will usecontrol signal 115 to start, stop, and otherwise control embeddedsecurity processor 173 as determined by the security needs ofsystem 100. Sincenetwork interface 177 is attached to the unsecure communications network, all communication traffic betweenmain processor 110 and the unsecure network must pass through embeddedsecurity processor 173. Embeddedsecurity processor 173 blocks all unwanted communications traffic from reachingmain processor 110 orsystem bus 105 while allowing desired traffic to be passed on tomain processor 110 viasystem bus 105 or some other computer systems vianetwork interface 175. Embeddedsecurity processor 173 therefore isolatessystem bus 105 from the network interfaces 175 and 177, thereby providing another layer of security that does not exist in the prior art. In addition, embeddedsecurity processor 173 can handle incoming communication packets according to the security processes as directed bymain processor 110.

Additionally, embeddedsecurity processor 173 may transform data packets, if necessary. This will typically involve an encryption/decryption process to maintain the confidentiality of certain packets. As mentioned above, certain information contained in packet headers and descriptors may reveal information about the network and aboutsystem 100 that can be utilized by intruders to gain unauthorized access tosystem 100. To prevent this, embeddedsecurity processor 173 may translate or transpose addresses as they come and go so that systems on the unsecure network cannot learn the real addresses of the protected resources.

As shown in FIG. 1, secure network communication traffic can be routed tomain processor 110 viasystem bus 105 by usingnetwork interface 120, essentially bypassingexpansion board 170. This optional feature allows network connectivity forsystem 100 without the additional overhead of using the firewall capabilities ofexpansion board 170 unless necessary.Network interface 120 is a hardware component specifically adapted to provide an interface or connection to a given network. The exact configuration ofnetwork interface 120 is a design choice that will depend on the type of network connection desired and the availability of various types of connections for a given network hardware/software protocol. Ifoptional network interface 120 is not provided, communication betweenmain processor 110 and the secure network may take place by usingnetwork interface 175.

The security tasks performed by embeddedsecurity processor 173 andexpansion board 170 may vary and may be adapted according to the specific network environment and security needs associated withsystem 100. Examples of typical security tasks that would be performed byexpansion board 170 to protectsystem 100 from the Internet or other unsecure network include packet filtering, data encryption, proxy serving for TCP/IP protocols such as Telnet, HyperText Transfer Protocol (HTTP), and File Transfer Protocol (FTP). In addition, embeddedsecurity processor 173 keeps a log of all activities performed. The activity log information can be sent immediately or periodically tomain processor 110, toDASD 180, or to both. If the activity log information is to be sent by embeddedsecurity processor 173 toDASD 180 for storage, thenmain processor 110 must have previously arranged for a writeable section of storage onDASD 180 with access authorization provided for embeddedsecurity processor 173.

In a preferred embodiment of the present invention, embeddedsecurity processor 173 sends the log information toDASD 180 for storage on a writeable portion ofDASD 180. On a daily basis,main processor 110 reads the activity log information fromDASD 180 and stores the activity log information in a protected section ofDASD 180 that cannot be accessed by embeddedsecurity processor 173.Main processor 110 controls the activity log procedures and determines what information will be logged, the frequency and location of storage, etc. In addition, certain activities can be used to flag immediate notification tomain processor 110, regardless of the normal, prearranged logging procedures. For example, if a certain activity, such as unauthorized access, is attempted n times in m minutes, a warning notification may be triggered and sent immediately tomain processor 110.

The operating system and security programs for embeddedsecurity processor 173 are obtained from a portion ofDASD 180 that is fully accessible bymain processor 110 but is read-only accessible to embeddedsecurity processor 173. The firewall configuration data is similarly stored in a protected area ofDASD 180. This means that the security programs and firewall configuration can only be changed or updated bymain processor 110. Embeddedsecurity processor 173 is initialized with the desired security instructions and firewall configuration at system startup. Since the data is presented to embeddedsecurity processor 173 as read-only, neither embeddedsecurity processor 173 nor entities outside the secure network ofsystem 100 can alter the security programs or firewall configuration.

User authentication information 140,initial firewall configuration 150, andfirewall monitoring program 160 are all stored inmain memory 130.User authentication program 140,initial firewall configuration 150, andfirewall monitoring program 160 are all examples of firewall control programs and are executed bymain processor 110 to control the activity of embeddedsecurity processor 173.

User authentication information 140 can be used to verify which users have access to controlled areas ofsystem 100. For example,user authentication information 140 can restrict or allow access to certain portions or areas ofsystem 100 based on pre-determined user profiles and information access requirements. In addition,authentication information 140 can be used by embeddedsecurity processor 173 when examining network communication packets. Embeddedsecurity processor 173 can extract authentication information (e.g. userid/password, X.509 certificate, etc.) from a packet and present the information tomain processor 110 for verification.Main processor 110 can be configured to return a boolean (yes/no) response as to whether or not the packet or packets should be authorized transmission within the secure area ofsystem 100. This feature can be used to control access for which users on the secure network can access the unsecure network (e.g., Internet).

Referring now to FIG. 3, asystem 300 according to a preferred embodiment of the present invention includes: a firewall protectedcomputer system 100 and multiple firewall protectedcomputer systems 220. The components of the computer systems shown in FIG. 3 are as described above in conjunction with FIGS. 1 and 2. It is important to note that the secure network connected to networkinterface 175 and the secure network connected to networkinterface 120 is the same network. In this configuration,computer system 100 provides the firewall between the secure and the unsecure networks. In this manner, firewall protectedcomputer systems 220 are isolated and kept secure from unauthorized accesses to and from the unsecure network.

The use of an embedded security processor according to a preferred embodiment of the present invention provides several significant advantages over conventional firewall systems. Specifically, the present invention provides a mechanism for application programs and security programs to be run on separate processors. This eliminates the possibility of one program interfering with the functional operation of the other. In addition, since the software and configuration information used by embeddedsecurity processor 173 appears to embeddedsecurity processor 173 as a read-only portion ofDASD 180, overall system security is enhanced. This means that unauthorized users who attempt to gain access through embeddedsecurity processor 173 will not be able to change the security configuration ofsystem 100. This feature also eliminates the possibility of infection by a virus or undesired modification of the configuration or other security programs that monitor network communications and provide security features forsystem 100.

Sincemain processor 110 and embeddedsecurity processor 173 are tightly coupled and communicate directly overinternal system bus 105, which is not directly connected to the external or unsecure network,internal system bus 105 is not subject to sniffing programs that may be used to monitor network communication traffic on Local Area Networks (LANs). Another advantage offered by the present invention is thatmain processor 110 can automatically disable embeddedsecurity processor 173 whenever tampering is detected, regardless of the conditions that are affecting the secondary processor. With existing firewall systems, the only way to remove the firewall from the network is to physically disconnect the firewall system from the network or to power down the firewall system.

Finally, a preferred embodiment of the present invention will generally be less expensive than a traditional firewall system because the entire embedded security processor can be manufactured on a single expansion board which can be inserted into industry standard hardware systems with minimal customization requirements. There is no requirement for a separate keyboard, mouse, or display unit. While this feature will reduce costs, it also provides additional security for the firewall because there is no way to access, update or alter the security programs stored inmain memory 130 except throughmain processor 110.

While the invention has been particularly shown and described with reference to preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention.

Claims

What is claimed is:

1. An apparatus comprising:

a processor;

a first network interface for connecting a system to a first network;

a second network interface for connecting the system to a second network; and

an embedded security processor coupled to the processor, to the first network interface, and to the second network interface, the embedded security processor ensuring that communications between the first and second networks are secure; and

at least one control signal coupled to the processor and to the embedded security processor, the processor controlling the operation of the embedded security processor via the at least one control signal and disabling the embedded security processor via the at least one control signal when the processor detects at least one predetermined error condition.

2. The apparatus of claim 1 wherein the at least one predetermined error condition comprises an activity by the embedded security processor designated as an undesired activity by the processor.

3. The apparatus of claim 1 wherein the at least one predetermined error condition comprises an unauthorized attempt by one of the first and second networks to access the other network.

4. The apparatus of claim 1 wherein the at least one control signal comprises at least one signal on a system bus coupled to the processor and to the embedded security processor.

5. The apparatus of claim 1 wherein the at least one control signal comprises at least one signal on a control bus coupled to the processor and to the embedded security processor.

6. The apparatus of claim 1 wherein one of the first and second networks is a secure network and the other is an unsecure network.

7. The apparatus of claim 1 wherein both the first and second networks are secure networks.

8. The apparatus of claim 1 further comprising:

a memory coupled to the processor, the memory containing at least one firewall control program, the processor executing the at least one firewall control program to control access between the first and second networks.

9. The apparatus of claim 8 wherein the firewall control program comprises a user authentication program.

10. The apparatus of claim 8 wherein the firewall control program comprises an initial firewall configuration program.

11. The apparatus of claim 10 wherein the initial firewall configuration program determines access allowed by the embedded security processor to the processor from the first and second networks.

12. The apparatus of claim 8 wherein the firewall control program comprises a firewall monitoring program.

13. The apparatus of claim 1 wherein the embedded security processor and the first network interface and the second network interface are located on an expansion board coupled to a system bus that is coupled to the processor.

14. A method for providing firewall protection between a first network and a second network, the method comprising the steps of:

initiating a connection on one of the first and second networks, the first and second networks being coupled to an apparatus, the apparatus including an embedded security processor coupled to the first network and to the second network, the embedded security processor coupled to a processor; and

using the processor to disable the embedded security processor when the processor detects an unauthorized attempt by one of the first and second network to access the other network.

15. The method of claim 14 further comprising the steps of:

providing a memory coupled to the processor, the memory containing at least one firewall control program; and

the processor executing the at least one firewall control program to control access between the first and second networks.

16. The method of claim 15 wherein the at least one firewall control program is a user authentication program.

17. The method of claim 15 wherein the at least one firewall control program is an initial firewall configuration program.

18. The method of claim 15 wherein the at least one firewall control program is a firewall monitoring program.

19. The method of claim 15 further comprising the step of:

the processor disabling the embedded security processor if the at least one firewall control program detects an activity by the embedded security processor designated as an undesired activity by the at least one firewall control program.

20. The method of claim 15 further comprising the step of:

the processor disabling the embedded security processor if the at least one firewall control program detects an unauthorized attempt by one of the first and second networks to access the other network.

21. The method of claim 14 further comprising the steps of:

the embedded security processor requesting firewall configuration data from the processor; and

the processor reading the firewall configuration data from a protected memory and passing the firewall configuration data to the embedded security processor.

22. The method of claim 14 further comprising the steps of:

the embedded security processor requesting at least one security program from the processor; and

the processor reading the at least one security program from a protected memory and passing the at least one security program to the embedded security processor.

23. A method for providing firewall protection between a first network and a second network, the method comprising the steps of:

the embedded security processor ensuring that communications between the first network and the second network are secure

providing at least one control signal to the processor and to the embedded security processor, the processor controlling the operation of the embedded security processor via the at least one control signal and disabling the embedded security processor via the at least one control signal when the processor detects at least one security-relevant condition.

24. The method of claim 23 wherein one of the first and second networks is a secure network and the other is an unsecure network.

25. The method of claim 23 wherein both the first and second networks are secure networks.

26. The method of claim 23 wherein the at least one security-relevant condition comprises an activity by the embedded security processor designated as an undesired activity by the processor.

27. The method of claim 26 further comprising the steps of:

28. The method of claim 26 further comprising the steps of:

29. The method of claim 26 further comprising the steps of:

the processor to creating an activity log for the activities of the embedded security processor; and

storing the activity log on a direct access storage device.

30. The method of claim 23 wherein the at least one security-relevant condition comprises an unauthorized attempt by one of the first and second network interfaces to access the other network interface.

31. The method of claim 23 further comprising the steps of:

32. The method of claim 31 wherein the at least one firewall control program is a user authentication program.

33. The method of claim 31 wherein the at least one firewall control program is an initial firewall configuration program.

34. The method of claim 32 wherein the at least one firewall control program is a firewall monitoring program.

35. The method of claim 32 further comprising the step of:

36. The method of claim 32 further comprising the step of:

37. The method of claim 23 further comprising the step of:

transferring information from a direct access storage device to the embedded security processor after receiving an authorization signal from the processor.

38. The method of claim 23 further comprising the step of:

transferring data to the embedded processor only after the processor has approved the transfer of information.